Matteo Campofiorito

Journalist, security expert, Linux enthusiast, environmentalist and MMA addicted

[plutos @plutos_eth]

What Lisa Su actually held on stage:

A mini PC the size of a lunchbox running Qwen3-235B locally, with no cloud and no discrete GPU

Inside: the Ryzen AI Max+ 395, 128GB unified memory, 110GB usable as VRAM on Linux

The first x86 chip that handles 200+ billion parameters on a single die

AMD claims it beats the RTX 5080 by several times on memory-bound models — because the 5080 simply cannot fit them

$1,400 to $2,500 once. cloud bills run $200 to $400 a month

It pays for itself in a few months, then costs nothing per request

This is not a faster GPU. it is the first real argument that your AI does not belong in someone else's data center

[GrapheneOS @GrapheneOS]

Today is the official release day for Android 17. We've already fully ported GrapheneOS to Android 17 and are in the process of pushing the code to our public repositories. We're building a final official release based on Android 16 QPR2 today and we'll do an initial Android 17 release tomorrow.

We've already tested the Android 17 port of GrapheneOS on the Pixel 6a, 7, 7a, 8, 10a, 10 and 10 Pro Fold. It will be possible for people to start building and testing it themselves later today once we finish pushing the code. We'll start the process of public testing for official releases tomorrow.

[Barry Schwartz @rustybrick]

Google says LLMS.txt files won’t harm or help your search rankings https://t.co/E595evHJB1

[Paolo Dal Checco @forensico]

Ho ricevuto in queste ultime ore - e così mi stanno segnalando anche altri - #PEC di #spam tutte da indirizzi di posta elettronica certificata #Legalmail (@tinexta @InfoCert_it).

Gli indirizzi di posta elettronica certificata dei mittenti sono tutti originali e appartengono ad aziende o soggetti esistenti, essendo le PEC firmate digitalmente dal provider non possono essere impersonati tramite spoofing e bypassano il filtro antispam: non è strano in sé se non il fatto che le PEC mittenti sono tutte registrate presso LegalMail e sono arrivate tutte tra ieri e oggi.

Alcuni esempi di PEC da cui io e altri segnalatori hanno ricevuto SPAM:

• lab****[email protected]
• hatto****[email protected]
• ***[email protected]
• v***[email protected]
• euroricambi***@legalmail.it
• emilio.asc****[email protected]

Se avete ricevuto anche voi spam via PEC autentiche, verificate se il mittente ha qualcosa in comune con questi che sarei curioso di conoscerne il motivo, potrà anche essere una coincidenza ma è certamente particolare.

[Damien Andell @AndellDam]

"If someone follows you from your Search profile, they may see more of your content on Discover."

I was saying it, but Google itself says it in its support documentation. Even if they don't all explain how it works.

[Claude @claudeai]

Introducing Claude Fable 5: a Mythos-class model that we’ve made safe for general use.

Its capabilities exceed those of any model we’ve ever made generally available.

[The Hacker News @TheHackersNews]

🚨 A website can figure out what you're doing on your computer.

No download. No permission. No popup.

> It's called FROST.
> Up to 95% accurate.
> And there's no fix yet.

You just leave the tab open, and JavaScript times your SSD to tell which sites you visit and which apps you open.

🔗 Learn how this works: https://t.co/kyvObeVoR4

[Matteo Campofiorito @matteoca]

OpenClaw AI Agents Begin Gaining Access to #VPN Connections https://t.co/zYXil7KgWq

[Malwarebytes @Malwarebytes]

🚨 YouTube creators, beware: A new phishing scam is targeting creators by using fake copyright strike alerts in order to steal login credentials and take over YouTube accounts.
https://t.co/OhJdpOR0H5

[Cyber Security News @The_Cyber_News]

🚨 Microsoft Defender 0-Day Vulnerability “RedSun” Enables Full SYSTEM Access

Source: https://t.co/s1vfh5GLcg

A newly disclosed zero-day vulnerability in Microsoft Defender, dubbed "RedSun," allows an unprivileged user to escalate privileges to full SYSTEM-level access on fully patched Windows 10, Windows 11, and Windows Server 2019 and later systems, and as of now, remains unpatched.

RedSun is the second zero-day exploit published within a two-week span in April 2026 by the security researcher known as "Chaotic Eclipse" (also referred to as Nightmare-Eclipse on GitHub).

RedSun follows the same exploit tradition but introduces an entirely new and independent attack vector, suggesting that Defender's architectural weaknesses run far deeper than a single isolated flaw.

#cybersecuritynews #Windowsdefender

[Paul Moore - Security Consultant  @Paul_Reviews]

Bypassing #EU #AgeVerification using their own infrastructure.

I've ported the Android app logic to a Chrome extension - stripping out the pesky step of handing over biometric data which they can leak... and pass verification instantly.

Step 1: Install the extension
Step 2: Register an identity (just once)
Step 3: Continue using the web as normal

The extension detects the QR code, generates a cryptographically identical payload and tells the verifier I'm over 18, which it "fully trusts".

This isn't a bug... it's a fundamental design flaw they can't solve without irrevocably tying a key to you personally; which then allows tracking/monitoring.

Of course, I could skip the enrolment process entirely and hard-code the credentials into the extension... and the verifier would never know.

[The Hacker News @TheHackersNews]

🛑 108 Chrome extensions with 20,000 installs were tied to one backend stealing user data.

They captured Google accounts, hijacked Telegram sessions, and injected scripts into every page—while posing as games and utilities.

🔗Read → https://t.co/uX9xvvdWYt

[Matteo Campofiorito @matteoca]

What Mythos Reveals About Zero Trust’s Scope Problem https://t.co/QDJNjwLKz2

[Matteo Campofiorito @matteoca]

How Google Detects AI Content and What SEOs Should Do About It https://t.co/zhuCUUMCR6

[Matteo Campofiorito @matteoca]

Supply Chain Attack on Axios Pulls Malicious Dependency from npm https://t.co/ltfzcKdRoX

[Matteo Campofiorito @matteoca]

Claude Code's source code appears to have leaked: here's what we know https://t.co/GEIubaY64R via @VentureBeat

[Matteo Campofiorito @matteoca]

SANS: Top 5 Most Dangerous New Attack Techniques to Watch https://t.co/Pdg5EtFVUQ via @Inoreader

[Kali Linux @kalilinux]

Kali Linux 2026.1 Release (2026 Theme & BackTrack Mode): New year, new release - Kali 2026.1 is here! There is everything from a fresh coat of paint to a nod to our roots, with normal ongoing improvements. Building on from December’s 2025.4, the summary… https://t.co/Xz0mWSTqCD

[Techmeme @Techmeme]

OpenAI plans to discontinue the app for its Sora video platform, as it refocuses on business and coding tools ahead of a potential IPO as soon as Q4 (@berber_jin1 / Wall Street Journal)

https://t.co/puhZOCFf62

https://t.co/yNgzDlPrXY

📥 Send tips! https://t.co/wlNZvXuhJs

[Matteo Campofiorito @matteoca]

Someone has publicly leaked an exploit kit that can hack millions of iPhones https://t.co/H0zPi0aYsm via @techcrunch